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[ABSTRACT OF THE DISCLOSURE] 

[ABSTRACT] 

The present invention relates to a method for tracing 
reserved resources GTP (GPRS Tunnel Protocol) user message 
trafficked between SGSN (Serving GPRS Support Node) and GGSN 
(GPRS Gateway Serving Node) . The present invention includes 
the steps of setting the tracing function for reserved 
resources of the subscriber message by using the TEID of the 
subscriber to be traced and outputting information for the 
corresponding resource by detecting the subscriber message 
with a set of the tracing function. The present invention 
effectively manages packet troubles generated from the SGSN by 
understanding of the GTP resource allotted to a corresponding 
GTP-U message that is the data of the subscriber and the 
attack of such EEOS through the GTP-U on Internet by isolating 
only the interface generating the corresponding attack. 
Further, the present invention may prevent declining of 
conducting capacity on a system by discontinuing the GTP-U 
tracing automatically through tracing function duration time 
and tracing critical value. 

[TYPICAL DRAWING] 

FIG. 7 
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[SPECIFICATION] 

[TITLE OF THE INVENTION] 

METHOD FOR TRACING GPRS TUNNEL PROTOCOL RESOURCE 
[BRIEF DESCRIPTION OF THE DRAWINGS] 

FIG. 1 illustrates a block diagram showing a related 
art GTP resource tracing system. 

FIG. 2 illustrates a diagram showing a structure of 
related art tracing information DB according to the related 
art . 

FIG . 3 illustrates a flow chart describing a related 
art GTP-C tracing function setting process. 

FIG. 4 illustrates a flow chart describing a related 
art GTP-C tracing operation. 

FIG. 5 illustrates a block diagram showing a GTP 
resource tracking system according to the present invention. 

FIG. 6 illustrates a diagram showing a structure of the 
tracing information DB according to the present invention. 

FIG. 7 illustrates a flow chart describing a GTP-U 
tracing operation according to the present invention. 

FIG. 8 illustrates a flow chart of an operation of a 
call-tracing unit for setting GTP-U tracing function in FIG. 7. 

FIG. 9 illustrates a flow chart of an operation of a 
call manager for setting GTP-U tracing function in FIG. 7. 

FIG. 10 illustrates a flow chart for describing GTP-U 
tracing operation of a packet processor in FIG. 7. 
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FIG. 11 illustrates a flow chart for describing GTP 
resource information output operation of call-tracing part in 
FIG. 7. 

* Reference numerals of the essential parts in the drawings* 

10 : SGSN 20 : GGSN(20) 

21 : SGSN interface unit 22 : packet processor 

23 : internet interface unit 

24 : call-tracing unit 

25 : tracing information DB 26 : call manager 
30 : MM I 

[DETAILED DESCRIPTION OF THE INVENTION] 
[OBJECT OF THE INVENTION] 

[FIELD OF THE INVENTION AND DISCUSSION OF THE RELATED ART] 

The present invention relates to a method for tracing 
GTP (GPRS Tunnel Protocol) resource, and more particularly, to 
a method for managing an attack of DDOS (Distributed Denial of 
Service) from outside to GGSN or an error of a packet 
transmission of a particular subscriber by tracing allotted 
resources of a GTP user message trafficked between SGSN 
(Serving GPRS Support Node) and GGSN (GPRS Gateway Serving 
Node) . 

In general, the SGSN which is a GPRS serving node 
providing packet service to a mobile terminal is connected to 
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the GGSN through the GPRS back bone network based on IP. The 
GGSN directly connected to an external packet data network 
(Internet) for performing tunneling and routing functions. As 
illustrated in FIG . 2, the GGSN includes a SGSN interface unit 
(21), a packet processor (22), an internet interface unit (23), 
and a call manager (26) . 

The call manager (26) generates a tunnel between the 
SGSN (10) and the SGSN interface unit (21) by using GTP-C (GTP 
Control Message) by operating together with the packet 
processor (22) and the SGSN (10) when call of a user is 
required to be set. The GTP-U (GTP User Message) is trafficked 
through the generated tunnel. 

Furthermore, the GGSN (20) includes a call-tracing unit 
(24) for tracing a corresponding GTP-C and reports the 
resource information (hereinafter abbreviated GTP resource 
information) reserved by a corresponding message to the 
operator when a call tracing request signal for a particular 
subscriber is received from the operator through the MMI (Man 
Machine Interface) (30) and a DB (25) for storing information 
of a call tracing in progress. 

Upon receiving the call tracing request signal from the 
operator, the call-tracing unit (24) sets a GTP-C tracing 
function by storing an identification information (hereinafter 
'tracing information') of a tracing object subscriber included 
in the corresponding message into the tracing information DB 
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(25), and reports the GTP resource information to the operator 
through the MM I (30) when the GTP resource information is 
received from the call processor (26) . 

The tracing information is stored by the call-tracing 
unit (24) . Referring to FIG. 2, the tracing information DB 
(25) searched in the call-manager (26) when tracing GTP-C 
includes a INDEX field of the stored tracing information, an 
IMSI field (International Mobile Subscriber Identifier), a 
IMSI_CNT field indicating the decimal point of the 
corresponding subscriber, an IP_ADDR field for storing an IP 
(Internet Protocol) address of the corresponding subscriber, 
and a TRC_TYPE field for indicating the corresponding tracing 
type. 

The detailed structure of the TRCJTYPE field is shown 

below. 



[Table 1] 



bit 8 


bit 7 


bit 6 


bit 5 


bit 4 


bit 3 


bit 2 


bit 1 


Priority 


Reserved 


BSS Record Type 


SGSN Record Type 


Invoking Event 



Referring to Table 1, in connection with GTP-C tracing, 
U' is set for indicating that the developer can use the bit 3 
to bit 7 arbitrarily to each Invoking Event bit which is a 
call tracing generation event as specified in GSM12.08. 

Then, the SGSN Record Type bit is set to 0, 1 if the 
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corresponding tracing type is call-detecting, and set to 0 if 
the corresponding tracing type is call-tracing, and set to 1, 
1 is call-tracing cancellation. The call-detecting outputs 
call time and location information of the subscriber of the 
corresponding call after the call of tracing object subscriber 
is completed. The call detecting outputs the corresponding 
message as the GTP-C is received. 

The present invention will be described with reference 
to the attached drawing showing GTP-C tracing operation in 
GGSN (20) . 

FIG. 3 illustrates a flow chart describing a related 
art GTP-C tracing function setting process of the call-tracing 
unit (24). Referring to FIG. 3, the call-tracing unit (24) 
receives GTP-C tracing request message of an operator through 
MM I (30) (S301) . The GTP-C tracing request message includes 
tracing information about IMSI of tracing object subscriber or 
IP address and tracing type. 

The call-tracing unit received the corresponding GTP-C 
tracing request message analyzes the received message and 
stores the tracing information in the corresponding message in 
the tracing information DB (25) . And then, when the tracing 
information is successfully stored in the tracing information 
DB (25) and the setting is completed, the call-tracing unit 
(24) outputs GTP-C tracing function setting success message to 
the operator (S303, S304), and outputs GTP-C tracing function 
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setting failure message when the information storage is failed 
(S303, S305) . 

FIG. 4 illustrates a flow chart describing a GTP-C 
tracing operation for a subscriber in which GTP-C tracing 
function is set as above. 

Referring to FIG . 4, the call manager (26) receiving 
GTP-C from SGSN (10) through the packet processor (22) 
determines whether resource of the packet processor (22) and 
an internet interface unit (23) is available or not and 
performs other call managing processes, and transmits the 
corresponding result to the subscriber. 

In this instance, the call manager (26) confirms 
whether the GTP-C tracing function is set or not for the 
corresponding subscriber by searching the tracing information 
DB (25) . 

As a result of the confirmation, if the corresponding 
function is set (S403) , a tracing type of the tracing 
information DB (25) is confirmed. If the corresponding tracing 
type is a call-tracing type, the received GTP-C is transmitted 
to the call-tracing unit (24) (S404, S405) and if the 
corresponding tracing type is call-detecting unit, the call 
end time and location information of the subscriber are 
transmitted to the call-tracing unit (24) after the 
corresponding call is released (S404, S406) . 

Herein, the call-tracing unit (24) reports a state of 
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call currently progressed to the operator when receiving the 
GTP-C (S407) and reports the call end time and location 
information of the subscriber received when the corresponding 
call is released (S408) . 

As described above, since call tracing is carried out 
only for the GTP-C, tracing for the GTP-U that is current user 
data is not carried out from the reserved resource in the 
exchanger. 

When trouble occurs in a packet transmitted from the 
SGSN, it is difficult for an operator of the exchanger to 
troubleshoot the underlying problem because it is difficult to 
exactly determine which interface unit is having the trouble. 

Furthermore, in a case of the GTP-U trafficked from the 
Internet, when the corresponding message is under an attack of 
DDOS, the interface being attacked is not identified. 
Therefore, fast troubleshooting is not possible and there is a 
serious problem of damaging security and reliability of the 
exchanger. 

[TECHNICAL TASKS TO BE ACHIEVED BY THE INVENTION] 

An object of the present invention is to acknowledge 
the GTP resource allotted to a GTP-U by tracing the GTP-U of a 
real subscriber using TEID of the subscriber to be traced. 

[SYSTEM AND OPERATION OF THE INVENTION] 
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To achieve these and other object and advantages, a 
method for tracing GTP resource according to the present 
invention includes the steps of setting the tracing function 
for reserved resources of the subscriber message by using the 
TEID of the subscriber to be traced and outputting information 
for the corresponding resource by detecting the subscriber 
message with a set of the tracing function. 

Preferably, the step of setting the tracing function 
includes the steps of: transmitting the user tracing 
information received from the operator in the call tracing 
unit to the call manager; searching TEID allotted to the user 
using the tracing information in the call manager; registering 
the user message tracing function to the packet processor and 
transmitting the TEID to the call tracing unit; and storing 
the TEID together with the tracing information in the tracing 
information DB. 

Preferably, the tracing information includes the IMSI 
and IP address of the subscriber, a tracing type for 
commanding the subscriber message tracing, and a trace 
critical value, i.e., a maximum number of the message of the 
subscriber to be traced. The tracing information, TEID and the 
trace count value that is the number of traced message are 
stored in the tracing information DB. 

Preferably, the TEID registering step includes the 
steps of: receiving the TEID and the tracing information in 
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the packet processor; and activating the tracing flag of the 
corresponding TEID field in an inner TEID table and storing 
the tracing information. 

The step of outputting the reserved resource 
information includes the steps of: confirming the TEID of the 
trafficked subscriber message in the packet processor; 
confirming whether the tracing flag of the confirmed TEID is 
activated by searching the TEID table; transmitting the 
reserved resource information of the subscriber together with 
the TEID to the call tracing unit when the tracing flag is 
activated; and outputting the reserved resource information to 
the operator by using the TEID from the call tracing unit. 

The reserved resource information includes an AMA 
number of trafficked subscriber message, an interface number, 
a VPI/VCI, a link band, a value directing a stream direction 
of the data, and the trace count value. 

The step of outputting the reserved resource 
information includes the steps of: confirming whether the TEID 
is stored by searching the tracing information DB; mapping the 
subscriber tracing information corresponding to the TEID and 
outputting the resource information to the operator when the 
resource information is stored in the TEID; increasing the 
track count value in the call tracing information DB and 
comparing the stored trace critical value; and deleting the 
TEID and the corresponding tracing information in the tracing 
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information DB when the trace count value is the same as the 
trace critical value. 

If there is time information for maintaining 
corresponding tracing function in the tracing information, a 
step of operating a timer corresponding to the duration is 
further includes when the TEID is received form the call 
tracing unit. 

The call tracing unit cancels the tracing function of 
the corresponding subscriber message by deleting the TEID and 
the corresponding tracing information from the tracing 
information DB when the timer is terminated. 

If the call for the subscriber is canceled, a step of 
canceling the set of the tracing function is further included. 
The step of canceling the tracing function includes the steps 
of: transmitting a session termination notice having 
identification information of the subscriber whose call is 
canceled at the call tracing unit to the call tracing unit; 
and canceling the subscriber message tracing information by 
deleting the corresponding TEID and the tracing information in 
the tracing information DB using the identification 
information at the tracing information DB. 

It is to be understood that both the foregoing general 
description and the following detailed description of the 
present invention are exemplary and explanatory and are 
intended to provide further explanation of the invention as 
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claimed. 

Referring to FIG. 5, the GTP-U tracing system according 
to an embodiment of the present invention is same as the 
conventional system. However, the call tracing unit (24) 
receives GTP-U tracing request which is a request for tracing 
of GTP-U reserved resource of a specified subscriber from the 
operator through MM I (30) . 

The GTP-U tracing request includes the tracing 
information. The tracing information includes information such 
as the IMSI or an IP address, a tracing type, a trace critical 
value, and further includes information of tracing function 
duration time. 

IMSI is a subscriber identification number and IP is an 
address allotted to the corresponding subscriber to call 
through the internet. The tracing type refers to a method of 
performing a corresponding tracing. In a case of tracing the 
GTP-U, the SGSN (10) record-type bits are preferably set as in 
Table 1. 



[Table 2] 



Tracing type 


Bit4 


Bit3 


Bit2 


Bitl 


GTP-U tracing 


0 


1 


1 


1 



The critical value for tracing is a parameter for 
limiting the number of messages to be traced during GTP-U 
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tracing, and is divided into an up-stream critical value and a 
down-stream critical value according to a traffic direction of 
the message. The up-stream critical value is a maximum number 
of the tracing object messages trafficked from the SGSN (10) 
to the internet, and the down-stream critical value is a 
maximum number of the tracing object messages trafficked from 
the internet to the SGSN (10) . The trace critical value ends 
tracing GTP-U in a corresponding direction when the number 
(counted value) of traced messages reaches the trace critical 
value . 

The trace function duration time is a parameter to 
prevent the GTP-U from being excessively traced for the 
performance of the system, and move specifically corresponds 
to the duration of GTP-U tracing. Accordingly, if the trace 
function duration time is exceeded, the GTP-U tracing is ended 
when the number of the messages is under the trace critical 
value . 

The call-tracing unit (24) of the present invention 
transmits the IMS I or the IP address or the trace critical 
value in the received tracing information to the GTP-U manager 
(26), so as to request the GTP-U tracing function registration. 
The call-tracing unit (24) also reports a response of the GTP- 
U tracing function registration to the MM I (30) when the 
tracing function is registered, and reports the GTP resource 
information to the operator through the MM I (30) by mapping 
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the GTP resource information, the IMSI or IP address of the 
tracing object subscriber when the GTP resource information, 
i.e., the result of the GTP-U tracing is received from the 
packet processor (22) . 

The TEID is identifies a plurality of virtual tunnels 
allotted to each call between GTP layers of the SGSN (10) and 
the SGSN interface unit (21) . 

FIG. 6 shows a structure of the tracing information DB 
(25) . The tracing information DB (25) stores a tracing 
information index (INDEX), an IMSI of the subscriber to be 
traced, a digit number of the IMSI (IMSI_CNT), the IP address 
(IP_ADDR), the tracing type (TRC_TYPE) , the TEID mapped to the 
IMSI or IP address received from the call manager (26), a 
trace count value (Up/Down Stream CNT) , and the trace critical 
value (Up/Down Stream LMT) as well as .a timer identifier 
(TIMER_ID) operated during a corresponding duration when the 
trace function duration is received from the operator and the 
received trace function duration. 

The tracing information DB (25) may include a separate 
DB for tracing a conventional GTP-C. 

The call manager (26) sets a call of the subscriber by 
generating a tunnel networking with SGSN (10) when receiving 
GTP-C and performing call managing through the generated 
tunnel by mapping IMSI or IP address to arbitrarily TEID using 
a subscriber information table as shown in a table below. 
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[Table 3] 



IMS I 


IP address 


TEID 


Subscriber profile 



If GTP-U tracing function registration request 
including tracing information such as IMSI, IP address, or 
tracing critical value is received from the call-tracing unit 
(24), the call manager (26) registers GTP-U tracing function 
by transmitting the tracing information to a packet processor 
(22) by searching TEID mapped to the IMSI or IS address in the 
subscriber information table, and transmits the searched TIED 
to the call-tracing unit (24) . 

The packet processor (22) performs routing to the GTP-U 
received from the SGSN interface unit (21) using the TEID 
table so as to transmit the received GTP-U to the internet 
(not shown in the drawing) through the interface unit (23), or 
performs routing to the GTP-U received through the internet 
interface unit (23) so as to transmit the received GTP-U to 



the SGSN 


(10) through the 


SGSN interface unit 


(21) . 






[Table 4] 












TEID 


IP 


QoS 


Stream 


Tracing 


Trace 


Trace 




address 




band 


flag 


critical 


count 








(Up /Down) 




value 


value 1 



Further, when TEID and tracing information is received 
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from the call manager (26) in connection with the GTP-U 
tracing function registration, the packet processor (22) 
stores the tracing information (tracing critical value) to the 
corresponding field of the TEID table and activates a tracing 
flag . 

When the GTP-U with the TEID is detected, the packet 
processor (22) also transmits the GTP resource information as 
much as the trace critical value to the call-tracing unit (24) 
while increasing tracing count value. In this instance, when 
the trace count value is the same as the tracing critical 
value, the packet processor (22) inactivates the tracing flag 
and removes the corresponding CTP-U tracing function by 
deleting the trace count value and the trace critical value. 

The GTP resource information preferably includes 
information as shown in Table 5. 



[Table 5] 



Field 


Contents 


CNT 


Count reported to call tracing unit for UP/DOWN 
Stream 


STREAM DIR 


Stream direction 


AMA No 


AMA number (ATM Management Assemble) of SGSN 
interface unit / Internet interface unit 


INF No 


Interface number of SGSN interface unit / 
Internet interface unit 
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PORT No 


Port number of SGSN interface unit / Internet 
interface unit 


VPI/VCI 


VPI/VCI number of SGSN interface unit / Internet 
interface unit 


LINK BW 


UP/DOWN Stream link band of SGSN interface unit / 
Internet interface unit 



FIG. 7 illustrates a flow chart describing a GTP-U 
tracing operation according to the present invention. 

Referring to FIG. 7, the call-tracing unit (24) 
receives GTP-U tracing request signal including in the tracing 
information of the subscriber to be traced from the operator 
through the MM I (30) (S610) and sets the STP-U tracing 
function of the corresponding subscriber (S620) . 

In other words, the call-tracing unit (24) transmits 
the IMSI or IP address and the trace critical value in the 
tracing information so as to request the GTP-U tracing 
function registration, and the call manager (26) searches TEID 
mapped in IMSI or IP address received from the call tracing 
unit (24) in the subscriber information table like the Table 3, 
registers the GTP-U tracing function to the corresponding TEID 
by transmitting the searched TEID and the tracing critical 
value, and transmits the searched TEID to the call tracing 
unit (24) . 

Then, the call tracing unit (24) sets the GTP-U tracing 
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function by storing the tracing information received from the 
operator and the TEID received from the call manager (26) into 
the tracing information DB (25) . 

Meanwhile, the packet processor (22) traces GTP-U 
trafficked through the SGSN interface unit (21) and the 
internet interface unit (23), and transmits the GTP resource 
information reserved by the corresponding GTP-U message to the 
call tracing unit (24) when the GTP-U to be traced is detected 

(S640) . The call tracing unit (24) then reports the received 
GTP resource information to the operator through the MM I (30) 

(S660) . 

FIG. 8 is a flow chart showing an operation of a call 
tracing unit (24) for setting the GTP-U tracing function. 
Referring to FIG . 8, the call tracing unit (24) receives the 
GTP-U tracing request message from the operator through the 
MM I (30) (S610) . The GTP-U tracing request message includes 
the IMSI or IP address, i.e., the tracing information for the 
subscriber to be traced, the trace critical value, and the 
trace function duration for limiting the corresponding tracing 
time . 

The call-tracing unit (24) stores the IMSI or IP 
address in the GTP-U tracing function registration request 
message and transmits the tracing information to the call 
manager (26) so as to request the GTP-U tracing function 
registration (S621) . In this case, the call tracing unit (24) 
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sets time-out as long as a time of IMR1 for detecting whether 
a response message is received from the call manager (26) 
within a predetermined time. 

Upon receiving the GTP-U tracing function registration 
response message corresponding to GTP-U tracing function 
registration request from the call manager (26) (S622), the 
call tracing unit (24) searches the result value stored in the 
response message, and operates a timer corresponding to the 
trace function duration contained in the tracing information 
from the operator (S623, S624) if the registration value is 
the registration success (the GTP-U tracing flag is activated) . 

In other words, when the GTP-U tracing function 
registration is succeeded, a timer termination signal storing 
the TEID received from the call manager (2 6) together with the 
trace function duration is registered into an OS such that the 
timer termination signal reporting a termination of the trace 
function duration can be received. In this instance, when the 
registration of the timer termination signal fails, the call 
tracing unit (24) reports to the operator that setting the 
GTP-U tracing function is failed. 

Setting the GTP-U tracing function according to the 
GTP-U tracing request of the operator is finished (S625) by 
storing the received tracing information from the operator and 
the TEID contained in GTP-U tracing registration response 
message received from the call manager (26) . 
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Meanwhile, when there is no response message for the 
GTP-U tracing function registration request from the call 
manager (26) (S622), or the result value of the response 
message for the corresponding GTP-U tracing function 
registration request is a value (FAIL) indicating the failure 
of the registration (S623) , the failure of setting the GTP-U 
tracing function is reported to the operator (S626) . 

FIG. 9 is a flow chart showing an operation of a call 
manager (26) for setting STP-U tracing function. Referring to 
FIG. 9, the call manager (26) receives the GTP-U tracing 
function registration request message from the call tracing 
unit (24) (S631) and confirms whether the call for the 
corresponding subscriber exists by decoding the IMSI or IP 
address from the tracing information contained in the 
corresponding message (S632, S633) . 

As a result of the above confirmation, in case there is 
a corresponding call, the call manager (26) searches the TEID 
mapped to the IMSI or IP address by searching the subscriber 
information table like the Table 3 (S634), and registers GTP-U 
tracing function by transmitting the searched TEID together 
with the tracing information (trace critical value) to the 
packet processor (22) (S635) . And then, the call manager (26) 
sets the result value (SUCCESS) indicating a success of the 
registration to the GTP-U tracing function registration 
response message and transmits the GTP-U tracing function 
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registration response message together with the TEID to the 
call-tracing unit (24) (S636) . 

As a result of the confirmation whether the call for 
the subscriber at the step exists (S633) , when the call does 
not exist, the call manager (26) sets the result value (FAIL) 
indicating a registration failure to the GTP-U tracing 
function registration response message and transmits the GTP-I 
tracing function registration message to the call tracing unit 
(24) (S637) . 

FIG. 10 is a flow chart showing GTP-U tracing operation 
of a packet processor (22). Referring to FIG. 10, the packet 
processor (22) stores the received tracing information in a 
trace critical value field corresponding to the received TEID 
in the TEID table as in Table 4 and activates the 
corresponding tracing flag (S642) when the TEID related to the 
GTP-U tracing function registration and the tracing 
information (trace critical value) are received from the call 
manager (26) . 

The packet processor (22) receives the GTP-U trafficked 
through the SGSN (10) interface unit (21) or the internet 
interface unit (23), and confirms the TEID of the 
corresponding message and the packet processor (22) confirms 
whether the tracing flag for the corresponding TEID is 
activated by searching the confirmed TEID in the TEID table 
with a search key (S633, 634) . 
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As a result of aforementioned confirmation, when the 
tracing flag is activated, the GTP resource information as in 
FIG. 5 and the TEID are stored on the GTP resource information 
message. The GTP resource information message is transmitted 
to the call tracing unit (24) (S645, S646) . 

The packet processor (22) increases the corresponding 
trace count value of the TEID Table by 1 (S647), compares the 
trace count value with the corresponding trace critical value 
(S648), performs a next GTP-U detection when the trace count 
value is not the same with the corresponding trace critical 
value (S644), or deletes the trace count value and the trace 
critical value and terminates the GTP-U tracing movement by 
inactivating the tracing flag (S649) when the trace count 
value is the same as the corresponding trace critical value. 

In this instance, comparison of the trace count value 
and the trace critical value is separately carried out for 
each of the up stream and down stream. Therefore, the GTP-U 
tracing movement of the corresponding stream is terminated 
when the trace count value of one of the up/down streams is 
the same as the trace critical value. 

FIG. 11 is a flow chart for outputting GTP resource 
information of a call tracing unit (24). Referring to FIG. 11, 
for a period of time when the timer corresponding to the 
tracing function duration is not terminated (S661), the call 
tracing unit (24) searches whether the corresponding TEID 
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included in the GTP resource information message received from 
the packet processor (22) is stored on the tracing information 
DB (25) by using the search key (S662, S663) . 

As a result of the search, the call tracing unit (24) 
aborts the received GTP resource information message when the 
TEID is not stored on the tracing information DB (25), and 
outputs the IMSI or IP address mapped to the TEID together 
with the GTP resource information contained in the GTP 
resource information message to the operator through the MM I 
30) when the TEID is stored on the tracing information DB (25) 
(S664) . 

In this instance, the GTP resource information includes 
the trace count value stored in the TEID table of the packet 
processor (22), and the trace count value is the same value as 
the trace count value stored in the tracing information DB 

(25) . However, when the trace count values are different from 
each other by the inconsistency of the packet processor (22) 
and the call tracing unit (24), the GTP resource information 
has the trace count value stored on the tracing information DB 

(25) . 

The call-tracing unit (24) which output the GTP 
resource information increases the corresponding trace count 
value of the tracing information DB (25) by 1, compares to the 
nest trace critical value (S665, S666) , cancels the timer by 
using the timer ID stored on the tracing information DB (25) 
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when the tracing count value and the trace critical value are 
the same (S667), and terminates the corresponding GTP-U 
tracing by deleting the data related to the corresponding TEID 
in the tracing information DB (25), i.e., the tracing 
information and the trace count value (S668) . 

In this instance, comparison of the trace count value 
and the trace critical value is separately carried out for 
each of the up/down streams. Therefore, the GTP-U tracing 
movement of the corresponding stream is terminated when one of 
the trace count values of the up stream and the down stream is 
the same as the trace critical value. 

Meanwhile, when the time corresponding to the tracing 
function duration is terminated, i.e., the timer termination 
signal registered in OS is received (S661), the call-tracing 
unit (24) searches the tracing information DB (25) by using 
the TEID contained in the timer termination signal as the 
search key, and detects all the corresponding data related to 
TEID so as to terminate the corresponding GTP-U tracing 
movement (S668). In this case, the timer termination signal is 
aborted when the TEID does not exist in the tracing 
information DB (25) . 

In the meantime, when the call of the subscriber to be 
traced is canceled, the call tracing unit (24) receives a 
session termination notifying message from the call manager 
(26), searches the tracing information DB (25) by using the 
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IMSI or IP address contained in the session termination 
notifying message and the TEID as the search key, deletes all 
the related data such as the tracing information and the trace 
count value corresponding to the corresponding TEID, and 
terminates the corresponding GTP-U tracing movement. 

When the operator requests to cancel the GTP=U tracing 
function for a particular subscriber whose GTP-U tracing 
function was set already, where the request is set in the GTP- 
U tracing function from the operator, the GTP-U tracing 
function is canceled through the same abovementioned GTP-U 
tracing function setting. 

FIG. 12 is a flow diagram for tracing GTP-U according 
to an embodiment of the present invention. 

Referring to FIG. 12, the call tracing unit (24) 
receives the GTP-U tracing request message including the 
tracing information for the subscriber to be traced from the 
operator through the MM I (30) (SI) and transmits the GTP-U 
tracing function registration request message containing the 
tracing information to the call manager (26) (S2). 

The call manager (26) searches TEID mapped to the IMSI 
or IS address from the tracing information and stores the 
information in the GTP-U tracing function registration request 
message together with the tracing information, and transmits 
to the packet processor (22) (S3) . 

Then, the packet processor (22) stores the tracing 
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information in the inner TEID table and registers the GTP-U 
tracing function by activating a tracing flag for the received 
TEID (S4), and transmits the GTP-U tracing function 
registration response message to the call manager (26) (S5) . 

The call manager (26) received the replay message 
transmits the GTP-U tracing function registration response 
message including the searched TEID to the call tracing unit 
(24) (S6) . The call tracing unit (24) sets the GTP-U tracing 
function for the corresponding subscriber by storing TEID 
included in the response message and the tracing information 
inputted from the operator to the tracing information DB (25) 
(S7) . 

Then, when detecting GTP-U having registered TEID (S8), 
the packet processor (22) transmits the resource information 
of the corresponding message and the GTP resource information 
message having the corresponding TEID to the call tracing unit 

(24) . The call tracing unit (24) searches the IMSI or IP 
address mapped in the TEID received from the tracing 
information DB (25), stores the searched IMSI or IP address 
and the GTP resource information onto GTP-U tracing result 
message, and reports to the operator through the MM I (30) 

(S10) . 

Meanwhile, the call tracing unit (26) transmits the 
session termination message to the call tracing unit (24) when 
the call of the subscriber to be traced is canceled (S12) . The 
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call tracing unit (24) cancels the tracing function for the 
corresponding subscriber by deleting the related data in the 
tracing information DB (25) using the IMSI, IP address or TEID 
contained in the corresponding message and reports it (S13) . 

Then, if the GTP-U tracing cancel request message 
containing the tracing cancel subscriber from the operator 
through MM I (30) (S14), the call tracing unit (24) transmits 
the GTP-U tracing function cancel request message having the 
subscriber information to the call manager (26) (S15) . 

The call manager (26) searches TEID mapped to the IMSI 
or IP address contained in the subscriber information, stores 
the searched TEID in the GTP-U tracing function cancel request 
message, and transmits to the packet processor (22) (S16) . 

Then, the packet processor (22) inactivates the tracing 
flag of the corresponding TEID in the inner TEID table and 
cancels the GTP-U tracing function (S17), and transmits GTP-U 
tracing function cancel response message to the call manager 
(26) (S18). 

The call manager (26) received the response message 
transmits the GTP-U tracing function cancel response message 
containing the TEID to the call tracing unit (24) (S19) . The 
call tracing unit (24) deletes all the related data in the 
tracing information DB (25) by using the TEID contained in the 
response message so as to terminate the GTP-U tracing function 
for the corresponding subscriber (S20) . 
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It will be apparent to those skilled in the art that 
various modifications and variations can be made in the 
present invention without departing from the spirit or scope 
of the inventions. Thus, it is intended that the present 
invention covers the modifications and variations of this 
invention provided they come within the scope of the appended 
claims and their equivalents. 

[EFFECT OF THE INVENTION] 

As has been described, the present invention traces the 
GTP-U of a subscriber using the TEID of the subscriber to be 
traced, to provide an improved understanding of the GTP 
resource allotted to a corresponding GTP-U message that is the 
data of the subscriber. 

Further, the present invention effectively manages 
packet troubles generated from the SGSN and the attack of such 
EEOS through the GTP-U on Internet by isolating only the 
interface generating the corresponding attack. 

Further, the present invention may prevent declining of 
conducting capacity on a system by discontinuing the GTP-U 
tracing automatically through tracing function duration time 
and tracing critical value. 
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What is claimed is : 

1. A method for tracing GTP resource including the 
steps of: 

setting the tracing function for reserved resources of 
the subscriber message by using the TEID of the subscriber to 
be traced; and 

outputting information for the corresponding resource 
by detecting the subscriber message with a set of the tracing 
function . 

2. A method for tracing GTP resource as claimed in 
claim 1, wherein the step of setting the tracing function 
includes the steps of: 

transmitting the user tracing information received from 
the operator in the call tracing unit to the call manager; 

searching TEID allotted to the user using the tracing 
information in the call manager; 

registering the user message tracing function to the 
packet processor and transmitting the TEID to the call tracing 
unit; and 

storing the TEID together with the tracing information 
in the tracing information DB. 

3. A method for tracing GTP resource as claimed in 
claim 2, wherein the tracing information includes the IMSI and 
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IP address of the subscriber, a tracing type for commanding 
the subscriber message tracing, and a trace critical value, 
i.e., a maximum number of the message of the subscriber to be 
traced. 

4. A method for tracing GTP resource as claimed in 
claim 2, wherein the tracing information, TEID and the trace 
count value that is the number of traced message are stored in 
the tracing information DB. 

5. A method for tracing GTP resource as claimed in 
claim 2, wherein the TEID registering step includes the steps 
of: 

receiving the TEID and the tracing information in the 
packet processor; and 

activating the tracing flag of the corresponding TEID 
field in an inner TEID table and storing the tracing 
information. 

6. A method for tracing GTP resource as claimed in 
claim 1, wherein the step of outputting the reserved resource 
information includes the steps of: 

confirming the TEID of the trafficked subscriber 
message in the packet processor; 

confirming whether the tracing flag of the confirmed 
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TEID is activated by searching the TEID tables- 
transmitting the reserved resource information of the 

subscriber together with the TEID to the call tracing unit 

when the tracing flag is activated; and 

outputting the reserved resource information to the 

operator by using the TEID from the call tracing unit. 

7. A method for tracing GTP resource as claimed in 
claim 6, wherein the reserved resource information includes an 
AMA number of trafficked subscriber message, an interface 
number, a VPI/VCI, a link band, a value directing a stream 
direction of the data, and the trace count value. 

8. A method for tracing GTP resource as claimed in 
claim 6, wherein the step of outputting the reserved resource 
information includes the steps of: 

confirming whether the TEID is stored by searching the 
tracing information DB; 

mapping the subscriber tracing information 
corresponding to the TEID and outputting the resource 
information to the operator when the resource information is 
stored in the TEID; 

increasing the track count value in the call tracing 
information DB and comparing the stored trace critical value; 
and 
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deleting the TEID and the corresponding tracing 
information in the tracing information DB when the trace count 
value is the same as the trace critical value. 

9. A method for tracing GTP resource as claimed in 
claim 2, wherein if there is time information for maintaining 
corresponding tracing function in the tracing information, a 
step of operating a timer corresponding to the duration is 
further includes when the TEID is received form the call 
tracing unit. 

10. A method for tracing GTP resource as claimed in 
claim 9, wherein the call tracing unit cancels the tracing 
function of the corresponding subscriber message by deleting 
the TEID and the corresponding tracing information from the 
tracing information DB when the timer is terminated. 

11. A method for tracing GTP resource as claimed in 
claim 1, wherein if the call for the subscriber is canceled, a 
step of canceling the set of the tracing function is further 
included. 

12. A method for tracing GTP resource as claimed in 
claim 11, wherein the step of canceling the tracing function 
includes the steps of: transmitting a session termination 
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notice having identification information of the subscriber 
whose call is canceled at the call tracing unit to the call 
tracing unit; and canceling the subscriber message tracing 
information by deleting the corresponding TEID and the tracing 
information in the tracing information DB using the 
identification information at the tracing information DB. 
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[Drawing] 

FIG. 1 

21 : SGSN Interface Unit 

22 : Packet Processor 

23 : Internet Interface Unit 

24 : Call Tracing Unit 
26 : Call Manager 

25 : Tracing Information DB 



FIG. 2 



Attribute 


Meaning 


INDEX 


Tracing Information Index 


IMSI 


Number of subscriber to be 
traced 


IMSI_CNT 


Digit Number of subscriber 


IP_ADDR 


IP Address of subscriber to be 
traced 


TRC_TYPE 


Current Tracing Type 



FIG. 3 
Start 

5301 : Receive GTP-C tracing request 

5302 : Store subscriber information to be traced into 
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tracing information DB 

5303 : In Storing succeed? 
Yes / No 

5304 : Output success message of setting tracing 
function 

5305 : Output failure message of setting tracing 
function 

End 



FIG, 4 
Start 

5401 : Receive GTP-C message 

5402 : Search tracing information DB 
Set tracing function? 

Yes / No 

5404 : Tracing type = Call tracing? 

5405 : Transmit GTP-C message to call tracing unit 

5406 : Transmit call end time and location information 
when call-canceling 

5407 : Report call processing situation to operator in 
call tracing unit 

5408 : Report information received from call tracing 
unit to operator 

End 
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FIG. 5 

(FIG. 1 4 7\Q 4M-) 

GTP resource information 



FIG. 6 



(fig. 2 *m S^SS*) 



TEID 


Tunnel Identifier 


DURATION 


Tracing function Duration 


Up/Down stream LMT 


Trace Critical Value 


Up/Down stream CNT 


Trace Count Value 


TIMER ID 


Timer Identifier 



FIG. 7 
Start 

S610 : Receive GTP-U tracing request 

S620 : Set tracing function to TEID of GTP-U message 
for subscriber to be traced 

S640 : Detect GTP-U message with registered TEID 

S660 : Output resource information of detected GTP-U 

message 

End 
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FIG. 8 
Start 

S610 : Receive the GTP-U tracing request 

5621 : Request registration of GTP-U tracing function 
by transmitting tracing information to call tracing unit 

5622 : Is GTP-U tracing function registration response 
message received? 

5623 : Is registration succeed? 

5624 : Operate timer 

5625 : Store tracing information and TEID 

S62 6 : Report failure of setting GTP-U tracing function 
to operator 
End 



FIG. 9 
Start 

5631 : Receive GTP-U tracing function registration 

5632 : Confirm IMSI or IP address in tracing 
information 

5633 : Does corresponding call currently exist? 

5634 : Search TEID mapped IMSI or IP address 

5635 : Transmit searched TEID and tracing information 
to packet processor and register GTP-U tracing function 

5636 : Transmit GTP-U tracing function registration 
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response for notifying success of registration to call-tracing 
unit 

S637 : Transmit reply to GTP-U tracing function 
registration for notifying failure of registration to call 
tracing unit 

FIG . 10 

5641 : Receive TEID and tracing information 

5642 : Store tracing information in corresponding field 
of TEID table and activate tracing flag 

5643 : Receive GTP-U message 

5644 : Search TEID table with TEID of GTP-U message as 
search key 

5645 : Is tracing flag of corresponding TEID activated? 

5646 : Transmit GTP tracing information to call tracing 

unit 

5647 : Increase corresponding count value of TEID table 

5648 : Trace count value = Trace critical value 

5649 : Delete trace count value, trace critical value 
and trace critical value of TEID table and inactive tracing 
flad 

End 

FIG. 11 
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Start 

5661 : Terminate timer 

5662 : Receive GTP tracing information and TEID from 
packet processor 

5663 : Search tracing information DB with TEID as 
search key 

5664 : Output GTP resource information together with 
IMSI or IP to operator 

5665 : Increase corresponding trace count value of 
tracing information DB 

5666 : Trace count value = Trace critical value? 

5667 : Cancel Timer 

5668 : Delete TEID related data from tracing 
information DB 

End 



FIG . 12 

JMr^-T- : call tracing unit 
31^ : call manager 
^^l^^nr : packet processor 
GTP-P tracing request 
Set GTP-U tracing function 
Report GTP-U tracing result 
Report session termination 
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GTP-U tracing cancellation request 
GTP-U tracing function termination 

GTP-U tracing function registration request 
GTP-U tracing function registration replay 
Session termination notification 
GTP-U tracing function cancellation request 
GTP-U tracing function cancellation replay 

GTP resource information 
Detect call cancellation 

GTP-U tracing function registration 

GTP-U message detection 

GTP-U tracing function cancellation 
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